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Abstract 

This paper investigates an efficient and practical information reconciliation method in the case where two parties have access 
to correlated continuous random variables. We show that reconciliation is a special case of channel coding and that existing coded 
' • modulation techniques can be adapted for reconciliation. We describe an explicit reconciliation method based on LDPC codes 

f «». ■ in the case of correlated Gaussian variables. We believe that the proposed method can improve the efficiency of quantum key 

^— ^ ' distribution protocols based on continuous-spectrum quantum states. 

Oh' I. Introduction 

■ We consider here the situation where two parties (Alice and Bob) have access to correlated but non-identical random variables 
and wish to agree on a common bit sequence. The imperfect correlation of the random variables inttoduces discrepancies 
between their data which cannot be corrected without additional communication. Reconciliation is the process of finding and 
correcting these discrepancies [1]. This problem can be viewed as a special case of source coding with side information [2], 
[3]; however the communication between the two parties is not bound to be one-way and interactive protocols could be used 
as well. An important application of reconciliation is the case where a third party (Eve) also has access to a correlated random 

• ■ variable but should have zero knowledge about Alice and Bob's reconciliated sequence. In fact this secret key agreement is 
q | usually performed in two steps: Alice and Bob first reconcile their data in order to get on a common sequence and then distill a 
1—1 > secret key using privacy amplification techniques [4]. The number of secret bits extracted by privacy amplification depends not 
only on the initial correlation between the random variables but also on the information leaked during reconciliation. Therefore 

■ one also often requires the reconciliation step to minimize the information leaked to the eavesdropper. 

t— I | The need for good reconciliation methods has recently appeared with the advent of Quantum Key Distribution (QKD). In 

I" fact QKD offers practical means of providing Alice and Bob with correlated random variables while bounding the information 
available to Eve [5], [6]. Let us briefly describe how secret key agreement is performed in such schemes. Alice first sends 

■ random quantum states to Bob via an insecure quantum channel. Noise in the channel introduces unavoidable errors in Bob's 
ly-j | measures, however the laws of quantum mechanics also guarantee that any attempt to eavesdrop the channel introduces 

■ additional discrepancy between Alice and Bob's data. Simple bit-error-rate evaluations are then performed on a fraction of the 
""^ | data to upper-bound the information available to the eavesdropper. Alice and Bob correct the errors in the remaining part of 

O ■ their data by running a reconciliation protocol over a classical authenticated public channel, which allows them to agree on 
^ | an identical sequence while minimizing the information leaked to the eavesdropper. Finally based on their estimation of the 
total information accessible to the eavesdropper, Alice and Bob extract a secret key using a privacy amplification protocol. The 
secret key is usually later used for cryptographic purposes, for instance to ttansmit secret messages with a one-time pad [7]. 

The reconciliation of discrete random variables has been extensively studied [1], [8] and many practical and efficient 
interactive protocols (Cascade, Winnow) have been designed and are now widely used in QKD applications. However little 
work has been devoted to the reconciliation of continuous random variables. Such correlations appear for instance during 
some QKD protocols based on the continuous modulation of quantum Gaussian states [9], [10], [11] and require specific 
reconciliation techniques. To our knowledge Sliced Error Correction (SEC) [12], [13] is the only reconciliation method for 
continuous random variables proposed so far. SEC makes use of asymptotically efficient interactive error correcting codes 
however its efficiency in practical cases is still far away from its optimal bound. 

This paper investigates a new one-way reconciliation method inspired from coded modulation techniques with LDPC 
codes whose results slightly improve those of [12]. The remainder of the paper is organized as follows. Section UTI shows 
how reconciliation can be viewed as a special case of channel coding with side information. In Section Hn] we present a 
general practical reconciliation method and show its connection with the technique of SEC. Section II VI gives an explicit code 
construction and numerical results in the case of correlated Gaussian random variables, with code choice optimized using 
Extrinsic Information Transfer (EXIT) charts. 
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II. Reconciliation and error control coding 

A. Source coding with side-information 

The two parties Alice and Bob each have access to the outcomes {xi}i.. n G M. n and {yi]i.. n G W L of n i.i.d. instances of 
two distinct correlated continuous random variables X, Y G M with joint probability distribution p(x, y). Alice and Bob then 
wish to distill a common binary string by exchanging information as shown in Fig. ^ We can assume without any restriction 
that the common binary string is the binary description of a quantized version of Alice's data only: {Q(xi)}i.. n where Q 
denotes a quantizer. As already noticed in [12], the quantization of X into X = Q(X) does not limit in itself the efficiency 
of the procedure since I{X; Y) can be made arbitrarily close to I(X; Y) by choosing a finer quantization. Note also that the 
discrete output of such a reconciliation procedure can then be used directly in conjunction with existing privacy amplification 
techniques. 
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Fig. 1. General reconciliation scheme. 



As stated earlier reconciliation can be viewed as a special case of source coding with side information. In fact Alice has to 
send Bob a compressed version of her symbols {xj}i..„ taking into account the fact that he has access to the symbols {z/i}i..„ 
as side information. If we let /™" be the minimum number of bits exchanged per symbol during reconciliation, we have (by 
the Slepian-Wolf theorem [2]): 

H{X\Y). (1) 
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Note that the Slepian-Wolf theorem only applies to discrete random variables. However if we use a quantized version Y of Y 
then the minimum information needed by Bob is H(X\Y) which can approach H(X\Y) with arbitrary precision [3]. 



B. Channel coding with side information 

The joint probability p(x, y) of the continuous random variables X and Y can always be written as the product p(y\x)p(x). 
In other words the symbols {yi}i.. n could have been obtained as the output of a memoryless channel C\ characterized by the 
transition probability pi(y\x) = p(y\x) when the i.i.d symbols {xj}i..„ are present at the input. 

Let us now give a general description of the quantizer. Let {Ij}i..k be a partition of R, let {x,}i..fc G {Ij}i..k be the 
corresponding quantized values and let Xj( x ) '■ ^ ~> {0> 1} be the indicator function of interval Ij, The function Q : K — > T> 



X 



maps the elements of M to elements in the discrete set V = {xi}i.j 

variable X takes the discrete values {xj}\,.k with probability pj = Pr 
can also be viewed as the output of a discrete input/continuous output channel 
P2(x\£j) = p(x)xj (x) / Pj when the symbols {Q(xj)}i..„ are present at the input. 



according to Q(x) = J2j=i %jXj( x )- Then the random 
= J p(x)xj(x)dx. Hence the symbols {xi}i.. n 
C2 characterized by the transition probabilities 
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Fig. 2. Reconciliation as channel coding. 

Finally the continuous symbols {yi}i.. n could have been generated by sending the discrete symbols {Q(xj)}i..„ through a 
channel C3 obtained by concatenating channels C\ and C2. Since X —> X — > Y is a Markov chain the transition probability 
is given by p(y\xf) = J pi(y\x)p2(x\xj)dx. The reconciliation of X and Y is then a special case of channel coding where 
symbols are transmitted over the channel C3, while the error correcting information is transmitted separately over an error-free 
channel and available at the receiver as side information. Since the achievable code rates over this channel are upper bounded 
by I(X; Y) < I(X; Y) we define the efficiency of a code with rate R c as: 
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where I re d is the number of redundant information bits per symbol added by the code. A code achieving capacity will have 
an efficiency rj = I(X;Y)/I(X;Y) and will introduce I™! 1 bits of information per symbol: 

I™T = H(X) - I(X; Y) = H(X\Y) (3) 

Notice that I™™ and I™™ are identical, hence this channel coding approach is strictly equivalent to the original source coding 
problem. 



III. Coded modulation for efficient reconciliation 

The practical efficiency of reconciliation relies on our ability to design good codes and decoders operating at a rate close 
to I(X; Y). Since each quantized value Xj can be uniquely described by a /-bits label (I = |~log 2 k~\) we can define I labeling 
functions C m : R — > {0, 1} (1 < m < m) that map any element iglto the mth bit of the label of Q(x). We then use the 
syndromes of {C m {xi)}i. ,i,i.. n according to a binary code as the side information sent by Alice to Bob on the public channel. 
Most standard coded modulation techniques such as Bit Interleaved Coded Modulation (BICM) [14], [15] and MultiLevel 
Coding / Multistage Decoding (MLC/MSD) [16], [17] schemes can be adapted and applied to reconciliation. Turbo codes and 
LDPC codes have already proved their excellent performance for error correction and side-information coding [18] therefore 
both are good candidates for efficient reconciliation. This paper focuses on LDPC codes although we believe that turbo-codes 
or any other strong channel codes would yield similar results. 



A. BICM and MLC/MSD 

Let i . . . bi i} denotes the I label digits of Alice's quantized number Q(xi). A soft-information decoder in a BICM or 
MLC/MSD scheme processes the data {j/i}i.. n and computes the Log-Likelihood Ratios (LLR) {Aj 

,Pr [&<,»» = l|{tf fc }i..«] 



A; 



log 



Pr[& M ' =0|{2/ fe }j 



(4) 



This LLR can be written as the sum of two distinct contributions Xff, and Afjjf which respectively describe intrinsic and 
extrinsic information: 
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with Av t h = {xj G T> : £i>(£j) = b} for b e {0, 1}. The intrinsic part \™f, exploits the existing correlation between X and Y 
to gather information about 6^/. Each term Pr bi. m = C m {xj) \ {yk}^ is actually a function of A?^ and C m (xj), therefore 
A™* also gathers all the information about 6^/ contained in the previously decoded bits {&,, m } m =H'. The expressions l|5} 
and l|6} are then ideally suited for iterative calculations. 

In the case of a BICM-like reconciliation a single code would be applied to an interleaved version of the whole bit 
string {jC m (ari)}i..j ) i.. n , see Fig. [3]whereas in the case of MLC/MSD-like reconciliation I individual codes would be applied 
successively to the I binary sequences £ m ({xi}i.. n ), see Fig. |4] Notice that when capacity approaching codes are used 
MLC/MSD is optimal whereas BICM in only suboptimal. MLC/MSD also usually offers more flexibility than BICM. There is 
no general method for designing efficient capacity approaching codes over the equivalent channel C3 of section HU However 
when the correlation between X and Y is symmetric (p(y,x) = p(—y,—x)) and when the chosen quantizer and labeling 
strategy also preserve this symmetry property one could use LDPC codes optimized by density evolution [19]. 
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Fig. 3. BICM-like reconciliation. Alice's continuous data is sent through a quantizer Q, a binary mapper C and an interleaver II. The encoder computes 
syndromes which are then directly available on Bob'side. Bob decodes his data by iteratively demapping his symbols (A-box) and correcting errors. 
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Fig. 4. MLC/MSD-like reconciliation. Alice's data is sent through a quantizer Q and £ distinct binary mappers Cm- Syndromes are computed separately 
for each level. Bob decodes his symbols by iteratively processing the I levels. 



B. SEC as multistage hard decoding 

Interestingly the original SEC protocol is just a special case of MLC/MSD-like reconciliation where interactive Binary 
Correction Protocols (BCP) optimized for BSC are used as component codes and where the information passed between levels 
is simply the sign of Xffi- Since these BCPs perform perfect error correction it is sufficient to process the I levels successively. 

Let us briefly analyze the cost of this operation compared to optimal MLC-MSD. Let {£\{X) . . . £(X)} be the I random 
variables corresponding to the I label bits of X. Then using the chain rule of mutual information: 



I(X;Y) 



I{d{X)...Ci{X)-Y) 



= '£l(£ i (X)]Y\£ 1 (X)...£ i -i(X)) 
i=i 
i 

= • . • A-i(X)) - H(£i(X)\Y,£i(X) . ..£i-i(X)) 



(7) 



Let A4i \ Y, £i(X) . . . d-x(X)) j be the maximum-likelihood estimation of £i(X) used in SEC. If we assume that the 
symmetry condition is valid then H(£i(X)\£i(X) . . .£j_i(X)) = 1. and using Fano's inequality: 



I(X;Y)>J2[l-h(Pi)} 



(8) 



where pi = Pr 



£i(X) ^ Aii \ Y, £i(X) . . . £j_i(X))JJ and h is the binary entropy function. As expected treating all / levels 

as BSCs underestimates I(X;Y) and J2 i=1 [1 — h(pi)] only heads toward I(X;Y) asymptotically as / — > oo. For practical 
values of I (say less than 5) this approximation may not be tight enough to ensure a good reconciliation efficiency, even with 
perfect codes achieving capacity over the BSC. Note also that a careful evaluation of the information leaked is needed when 
interactive BCPs are used. The most general evaluation should take into account all the bits exchanged in both ways which 
dramatically reduces the efficiency of error correction at levels where the bit error rate is above a few percents. 

Despite its simplicity the practical interest of SEC with interactive BCPs is threefold. As stated earlier BCPs allow the 
two parties to achieve perfect error correction whereas one-way code only correct errors approximately (for instance the sum- 
product decoding of LDPC codes may leave a couple of errors uncorrected). The second advantage is that one can blindly 
apply an interactive BCP without bothering about the actual code rate needed while one-way code require a specific design 
for each rate. Finally the decoding complexity of BCPs is very low when compared to belief-propagation decoding . 



IV. Reconciliation of Gaussian Variables 

In this section we deal with the reconciliation of two Gaussian random variables X ~ Af(0, S) and Y = X + e where 
e ~ A/"(0, a) using MLC/MSD-like and BICM-like reconciliation with LDPC codes. Such correlations appear for instance 
during Gaussian modulated QKD protocols. 

Since the probability distribution p(y, x) is Gaussian it satisfies the symmetry condition mentioned earlier. Following the 
quantization technique proposed in [12] the set of real numbers was split into an even number k of intervals {Ij}i..k symmetric 
around (this ensures the symmetry of the joint pdf between X and Y). The interval bounds were optimized using the simplex 
method in order to maximize I(X; Y). 
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A. Choice of codes and rates for MLC/MSD-like reconciliation 

In order to preserve the symmetry property a labeling strategy for MLC/MSD-like reconciliation should satisfy: 

Vm p(y,C m (Q(x))=b)=p(-y,C m (Q(x)) = b) (9) 

where b € {0,1} . We investigated two labeling strategies fulfilling this requirement: binary and anti-binary mappings. Both 
mappings assign to each interval j the /-bit representation (I = |~log 2 fc~|) of j + (2™ — k)/2 but in the binary case the 
least significant bit level is decoded first while in the antibinary case the most significant bit level is decoded first. The 
mutual informations I(Ci(X); Y\Ci(X) . . . Ci-\(X) in these two cases are plotted as a function of the normalized SNR 
101og(£ 2 /2cr 2 ) when k = 16 (I = 4) on Fig. |5(a)]and Fig. |5(b)l 
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(a) Binary mapping. (b) Anti-binary mapping. 

Fig. 5. Mutual information by level. 

Note that for low SNRs (< 2dB) the first two levels in the binary case are extremely noisy and the mutual information is 
close to 0. Designing good LDPC codes at such low rates is extremely hard and it is easier to disclose the entire level without 
compromising efficiency. With antibinary mapping all levels have non-zero mutual-information and no such simplification 
can be made. Therefore in all MLC/MSD simulations we used a binary mapping, and by carefully choosing the number of 
quantization intervals the number of codes actually needed for reconciliation was easily reduced to 2 or 3. 

The optimal code rate required at level i with a given SNR is: 

Ri pt = l-(Ii(oo)-Ii(SNR)), (10) 

where Ii(s) = I(Ci(X); Y\C\(X) . . . Ci-i(X), SNR — s). For instance the rates required with 16 quantization intervals, 
binary mapping at an SNR £ 2 /rj 2 = 3 are 0.002/0.016/0.259/0.921. In this case the effect of quantization is negligible since 
I(X;Y) differs from I(X;Y) by less than 0.02 bit/channel use. Full disclosure of the first two levels also has very little 
impact since these two levels contribute to I(X;Y) by less than 0.02 bit. 

In order to further simplify the code design we used irregular LDPC codes optimized for the AWGN channel as component 
codes. Good degree distributions with threshold close to capacity can easily be obtained via density evolution [20]. The block 
length used was 200, 000 and graphs were randomly generated while avoiding loops of length 2 and 4. Despite their long 
block length the performances of all constructed codes were still well below those of their capacity achieving counterparts. 
Achieving perfect error correction with high probability is in fact only possible at the cost of reducing the code rates. Cutting 
down the rates of each component code would disclose far too many bits, but a careful choice of the code and iterations 
between levels make it possible to achieve good reconciliation efficiency. 

We investigated a code choice strategy based on EXIT charts [21]. EXIT charts are a convenient tool to visualize the 
exchange of mutual information between the decoders and the demappers involved in MLC/MSD as shown in Fig. |4] 

The demapper transfer curves Ie = T^/a) cannot be computed in closed form but can be obtained via Monte-Carlo 
simulations using Eq. (j5Jl. The transfer curves Ie = T c (Ia) of the constructed LDPC codes were also obtained by Monte- 
Carlo simulations with Gaussian a priori information. The symmetry property allowed us to limit our simulations to the 
decoding of the all-zero codeword. Examples of transfer curves obtained with 100 iterations of sum-product decoding are 
given in Fig. [6] As expected our simulations showed that low rate codes gathered far less extrinsic information than high 
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rate codes. We decided to achieve perfect error correction by compromising on the rate of the high rate codes and by using 
iterations to compensate for the poor performance of lower rate codes. 




A priori information I 

Fig. 6. Transfer curves of constructed LDPC codes. 

Let us now detail how practical codes rates were found in the case Y? fa 2 = 3 with 16 quantization intervals (4 bits) and 
a binary mapping. As explained above the first two levels are disclosed and one would in theory need two ideal codes with 
rate 0.26 and 0.92 to perform MSD. We used instead a rate 0.25 code for the 3 rd level and looked for a high rate code that 
would gather enough extrinsic information at low SNR to start the decoding process and would correct all errors when a-priori 
information is 0.92. This search was performed by drawing EXIT charts and ensuring that iterations would allow complete 
decoding. We found that a LDPC code with rate 0.86 was a good compromise. Fig.0shows that realistic decoding trajectories 
are closed to the expected decoding behavior. The code rates obtained with the same procedure for different values of SNR 



LDPC 3 rd level 

- - LDPC 4* level 




A priori information l A 

Fig. 7. Iterative decoding trajectory when £ 2 /<r 2 = 3 with 16 quantization intervals and binary mapping. Decoding trajectory is averaged over 10 blocks. 

are given in Table |I] When rate-1 codes where required we used algebraic codes with error correcting capability of 1 instead 
of LDPC codes to correct the few erroneous blocks. 
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SNR 


Intervals 


I(X;Y) 


H(X) 


Optimum code rates 


Practical LDPC code rates 


1 


12 (4 levels) 


0.49 


3.38 


0.001/0.008/0.187/0.915 


0/0/0.16/0.86 


3 


16 (4 levels) 


0.98 


3.78 


0.002/0.016/0.259/0.921 


0/0/0.25/0.86 


7 


22 (5 levels) 


1.47 


4.23 


0.002/0.020/0.295/0.924/1 


0/0/0.28/0.86/1 


15 


32 (5 levels) 


1.97 


4.68 


0.002/0.025/0.332/0.934/1 


0/0/0.31/0.86/1 



TABLE I 



Parameters used for MLC/MSD-like reconciliation. 



B. Choice of codes and rates for BICM-like reconciliation 

In the previous section we constrained the mapping to satisfy the symmetry condition l|9} in order to simplify the code 
design at each level. In the case of BICM-like reconciliation a single code is now applied to an interleaved version of the 
label bits . Therefore provided that the mapping produces a balanced number of 0's and l's a code optimized for symmetric 
mappings will behave almost equally well with non-symmetric ones. Note that with LDPC codes no additional interleaving is 
needed due to the structure of the code. 

The optimal code rate required with a given SNR is: 



opt 



l 



H(X) - I(SNR) 
I : 



(11) 



where J(s) is the maximum BICM-capacity at SNR s. I(s) depends on the mapping and cannot be computed exactly, however 
if we let X m £ {0, 1} be the binary random variable at level m (1 < m < I) then we can estimate a lower and an upper 
bound: 



m— 1 



H{X) - H{X m \Y) < 1(a) < min \ H(X), ^ I(X m ;Y) 

m—l 



and obtain bounds on the optimal code rate: 



1 - 



E m =iH(X m \Y) 



< R op t < 1 — 



max{0,tf(l)-£^ =1 /(X m ;y)} 



(12) 



(13) 



/ " " I 

For instance with 16 quantization intervals, E 2 /cr 2 = 3 and a gray mapping the optimal rate is between 0.257 and 0.274. The 
maximum reconciliation efficiency is therefore less than 88%. When choosing a code one has to ensure that the rate is also 
compatible with the mapping used. Fig. [8] shows the transfer curves of a rate 0.16 LDPC code optimized for the Gaussian 
channel as well as various demapper transfer curves. All transfer curves where obtained via Monte-Carlo simulations with 
Gaussian a priori information. Perfect decoding is possible if the LDPC code transfer curve remains below the demapper 
curve. It clearly appears that all mappings cannot be used and that no mapping can gather high extrinsic information for both 
low and high a priori information. Gray mapping gathers the highest extrinsic information without a priori information but 
the slope of its transfer curve is the steepest, which means that it has to be associated with a strong code. The other mappings 
can be used with weaker but lower rate codes and are therefore not suitable for efficient reconciliation. 
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■ Antigray demapper 
- LDPC rate 0.16 
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Fig. 8. Transfer curves of demapper and code used in BICM-like reconciliation for E 2 /<t 2 = 3 and 16 quantization intervals. 
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Unfortunately even with Gray mapping and a strong code we found that the practical code rates were far below the optimal 
ones. As shown in Fig. [8] a rate 0.16 LDPC code is required to ensure full error correction even though the demapper initially 
feeds the decoder with 0.24 a priori information bits (note that this value is close to the lower bound on the optimal rate). 

C. Numerical results 

Table |H] shows the reconciliation efficiency obtained with our MLC/MSD-like procedure for different values of the SNR 
and compares it with the efficiency of SEC. Our simulations were performed over 50 blocks of size 200,000 and all errors 
were corrected. When rate-1 codes were required we used a BCH code with block length 4091 and error correcting capability 
t = 1. This disclosed slightly less than 0.003 additional bits per symbol sent. Since high-rate LDPC codes would sometimes 
fail to correct a couple of erroneous bits we also applied the same BCH code on top of these LDPC codes. 

All SEC results are given for a quantization with 32 intervals. The efficiencies tj™q X , Vsec rj^ EC respectively refer to the 
efficiency of SEC with ideal binary codes, interactive Cascade and one-way Cascade + Turbo-codes as reported in [22]. 
is the efficiency obtained with MLS/MSD like reconciliation using the code rates and quantizers of Table U while ?y™° x is the 
maximum efficiency attainable with capacity achieving codes. 



SNR 


^max 
/SEC 




VsEC 


'/MLC 


»?MLC 


1 


75% 


60% 


<50% 


98% 


79.4% 


3 


87% 


79% 


67% 


98% 


88.7% 


7 


90% 


84% 


76% 


98% 


90.9% 


15 


92% 


87% 


82% 


98.5% 


92.2% 



TABLE II 
Reconciliation efficiency. 



The proposed reconciliation procedure achieves close if no better efficiency that SEC with ideal codes. When compared to 
SEC with one-way codes our procedure improves the efficiency significantly. 

V. Discussion and conclusion 

We have shown that reconciliation is equivalent to channel coding with side information and that existing coded-modulation 
methods such as MLC/MSD and B1CM can be adapted. We noticed that SEC is in fact a sub-optimal implementation of 
MLC/MSD-like reconciliation. In the case of correlated Gaussian random variables we proposed a method to design efficient 
reconciliation schemes based on iterative MLC/MSD and BICM techniques with LDPC codes. Our simulations showed that 
MLC/MSD-like reconciliation achieves high efficiency and significantly improves previously reported results. 

Although the proposed reconciliation method performs well with LDPC codes optimized for the AWGN channel we believe 
that a more specific optimization would further improve the efficiency. For instance one could optimize LDPC codes with 
density evolution by taking into account the decoders and the demappers jointly. However from a practical prospective the 
procedure would lose its usefulness if the complexity of optimization procedure becomes significant. 

Finally our study was restricted to real random variables but the procedure can be straightforwardly extended to variables 
in R". 
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